I think an alternative to local root certs would be to use a public cert + dnsmasq on your LAN to resolve the requests to a local address.